From 78012791480c8fa7bc4fbbf0d2b7cbbe4de8975a Mon Sep 17 00:00:00 2001
From: Chris Buechler <cmb@pfsense.org>
Date: Thu, 12 May 2016 04:29:32 -0500
Subject: [PATCH] Store notices safely to prevent potential XSS when notices
 are displayed locally or by remote systems where they're shipped. Ticket
 #6154

---
 src/etc/inc/notices.inc | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/etc/inc/notices.inc b/src/etc/inc/notices.inc
index b50165d8e1..c496ddb273 100644
--- a/src/etc/inc/notices.inc
+++ b/src/etc/inc/notices.inc
@@ -90,11 +90,11 @@ function file_notice($id, $notice, $category = "General", $url = "", $priority =
 	}
 	$queuekey = time();
 	$toqueue = array(
-				'id'		=> $id,
-				'notice'	=> $notice,
-				'url'		=> $url,
-				'category'	=> $category,
-				'priority'	=> $priority,
+				'id'		=> htmlentities($id),
+				'notice'	=> htmlentities($notice),
+				'url'		=> htmlentities($url),
+				'category'	=> htmlentities($category),
+				'priority'	=> htmlentities($priority),
 			);
 	while (isset($queue[$queuekey])) {
 		$queuekey++;